Skip to content

Commit ffc1eed

Browse files
Shreyas-MicrosoftCopilot
Shreyas-Microsoft
and
Copilot
committed
fix(infra): add windows security audit DCR + OMS Security solution (ADO #43311)
Adds a Data Collection Rule that captures Windows audit success (EventID 4624) and audit failure (EventID 4625) Security events from the jumpbox VM and routes them to the Log Analytics workspace via the Microsoft-SecurityEvent stream. The DCR is associated with the VM through the Azure Monitor Agent extension (extensionMonitoringAgentConfig.dataCollectionRuleAssociations). The OMSGallery Security solution is installed on the workspace so the SecurityEvent table is populated for the routed stream. Pattern mirrors microsoft/Modernize-your-code-solution-accelerator#435 but the audit success and audit failure events are covered by a single xPath (Security!*[System[(EventID=4624 or EventID=4625)]]) routed via the Microsoft-SecurityEvent stream rather than Microsoft-WindowsEvent. All new resources are gated on enablePrivateNetworking && enableMonitoring so non-WAF / non-monitoring deployments are unaffected. Files touched: - infra/main.bicep (jumpboxVM AMA extension; new securitySolution + windowsVmDataCollectionRules) - infra/main_custom.bicep (same additions) Addresses SFI item: "data collection rule ['audit success','audit failure'] logs should be enabled". Work item: AB#43311 ADO: https://dev.azure.com/CSACTOSOL/CSA%20Solutioning/_workitems/edit/43311 Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
1 parent 817d529 commit ffc1eed

2 files changed

Lines changed: 176 additions & 0 deletions

File tree

‎infra/main.bicep‎

Lines changed: 88 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -413,6 +413,94 @@ module jumpboxVM 'br/public:avm/res/compute/virtual-machine:0.15.0' = if (enable
413413
}
414414
]
415415
enableTelemetry: enableTelemetry
416+
// SFI: associate the SecurityAuditEvents data collection rule with the
417+
// jumpbox VM via the Azure Monitor Agent extension. Routes Windows audit
418+
// success (4624) / audit failure (4625) events to Log Analytics. Disabled
419+
// when monitoring is off because the DCR is also gated on enableMonitoring.
420+
// (ADO #43311)
421+
extensionMonitoringAgentConfig: enableMonitoring
422+
? {
423+
enabled: true
424+
tags: allTags
425+
dataCollectionRuleAssociations: [
426+
{
427+
name: 'send-${logAnalyticsWorkspaceResourceName}'
428+
dataCollectionRuleResourceId: windowsVmDataCollectionRules!.outputs.resourceId
429+
}
430+
]
431+
}
432+
: null
433+
}
434+
}
435+
436+
// SFI: install the Azure Monitor "Security" solution on the Log Analytics
437+
// workspace so that the Microsoft-SecurityEvent stream produced by the data
438+
// collection rule below populates the SecurityEvent table. Same gate as the
439+
// DCR. (ADO #43311)
440+
resource securitySolution 'Microsoft.OperationsManagement/solutions@2015-11-01-preview' = if (enablePrivateNetworking && enableMonitoring) {
441+
name: 'Security(${logAnalyticsWorkspaceResourceName})'
442+
location: solutionLocation
443+
plan: {
444+
name: 'Security(${logAnalyticsWorkspaceResourceName})'
445+
publisher: 'Microsoft'
446+
product: 'OMSGallery/Security'
447+
promotionCode: ''
448+
}
449+
properties: {
450+
workspaceResourceId: logAnalyticsWorkspaceResourceId
451+
}
452+
}
453+
454+
// SFI: data collection rule that captures Windows Security audit success
455+
// (EventID 4624) and audit failure (EventID 4625) events from the jumpbox VM
456+
// and routes them to Log Analytics via the Microsoft-SecurityEvent stream.
457+
// (ADO #43311)
458+
var dataCollectionRulesResourceName = 'dcr-${solutionSuffix}'
459+
var dataCollectionRulesLocation = useExistingLogAnalytics
460+
? existingLogAnalyticsWorkspace!.location
461+
: logAnalyticsWorkspace!.outputs.location
462+
module windowsVmDataCollectionRules 'br/public:avm/res/insights/data-collection-rule:0.11.0' = if (enablePrivateNetworking && enableMonitoring) {
463+
name: take('avm.res.insights.data-collection-rule.${dataCollectionRulesResourceName}', 64)
464+
dependsOn: [securitySolution]
465+
params: {
466+
name: dataCollectionRulesResourceName
467+
tags: allTags
468+
enableTelemetry: enableTelemetry
469+
location: dataCollectionRulesLocation
470+
dataCollectionRuleProperties: {
471+
kind: 'Windows'
472+
dataSources: {
473+
windowsEventLogs: [
474+
{
475+
name: 'SecurityAuditEvents'
476+
streams: [
477+
'Microsoft-SecurityEvent'
478+
]
479+
xPathQueries: [
480+
'Security!*[System[(EventID=4624 or EventID=4625)]]'
481+
]
482+
}
483+
]
484+
}
485+
destinations: {
486+
logAnalytics: [
487+
{
488+
workspaceResourceId: logAnalyticsWorkspaceResourceId
489+
name: 'la-${dataCollectionRulesResourceName}'
490+
}
491+
]
492+
}
493+
dataFlows: [
494+
{
495+
streams: [
496+
'Microsoft-SecurityEvent'
497+
]
498+
destinations: [
499+
'la-${dataCollectionRulesResourceName}'
500+
]
501+
}
502+
]
503+
}
416504
}
417505
}
418506

‎infra/main_custom.bicep‎

Lines changed: 88 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -391,6 +391,94 @@ module jumpboxVM 'br/public:avm/res/compute/virtual-machine:0.15.0' = if (enable
391391
}
392392
]
393393
enableTelemetry: enableTelemetry
394+
// SFI: associate the SecurityAuditEvents data collection rule with the
395+
// jumpbox VM via the Azure Monitor Agent extension. Routes Windows audit
396+
// success (4624) / audit failure (4625) events to Log Analytics. Disabled
397+
// when monitoring is off because the DCR is also gated on enableMonitoring.
398+
// (ADO #43311)
399+
extensionMonitoringAgentConfig: enableMonitoring
400+
? {
401+
enabled: true
402+
tags: allTags
403+
dataCollectionRuleAssociations: [
404+
{
405+
name: 'send-${logAnalyticsWorkspaceResourceName}'
406+
dataCollectionRuleResourceId: windowsVmDataCollectionRules!.outputs.resourceId
407+
}
408+
]
409+
}
410+
: null
411+
}
412+
}
413+
414+
// SFI: install the Azure Monitor "Security" solution on the Log Analytics
415+
// workspace so that the Microsoft-SecurityEvent stream produced by the data
416+
// collection rule below populates the SecurityEvent table. Same gate as the
417+
// DCR. (ADO #43311)
418+
resource securitySolution 'Microsoft.OperationsManagement/solutions@2015-11-01-preview' = if (enablePrivateNetworking && enableMonitoring) {
419+
name: 'Security(${logAnalyticsWorkspaceResourceName})'
420+
location: solutionLocation
421+
plan: {
422+
name: 'Security(${logAnalyticsWorkspaceResourceName})'
423+
publisher: 'Microsoft'
424+
product: 'OMSGallery/Security'
425+
promotionCode: ''
426+
}
427+
properties: {
428+
workspaceResourceId: logAnalyticsWorkspaceResourceId
429+
}
430+
}
431+
432+
// SFI: data collection rule that captures Windows Security audit success
433+
// (EventID 4624) and audit failure (EventID 4625) events from the jumpbox VM
434+
// and routes them to Log Analytics via the Microsoft-SecurityEvent stream.
435+
// (ADO #43311)
436+
var dataCollectionRulesResourceName = 'dcr-${solutionSuffix}'
437+
var dataCollectionRulesLocation = useExistingLogAnalytics
438+
? existingLogAnalyticsWorkspace!.location
439+
: logAnalyticsWorkspace!.outputs.location
440+
module windowsVmDataCollectionRules 'br/public:avm/res/insights/data-collection-rule:0.11.0' = if (enablePrivateNetworking && enableMonitoring) {
441+
name: take('avm.res.insights.data-collection-rule.${dataCollectionRulesResourceName}', 64)
442+
dependsOn: [securitySolution]
443+
params: {
444+
name: dataCollectionRulesResourceName
445+
tags: allTags
446+
enableTelemetry: enableTelemetry
447+
location: dataCollectionRulesLocation
448+
dataCollectionRuleProperties: {
449+
kind: 'Windows'
450+
dataSources: {
451+
windowsEventLogs: [
452+
{
453+
name: 'SecurityAuditEvents'
454+
streams: [
455+
'Microsoft-SecurityEvent'
456+
]
457+
xPathQueries: [
458+
'Security!*[System[(EventID=4624 or EventID=4625)]]'
459+
]
460+
}
461+
]
462+
}
463+
destinations: {
464+
logAnalytics: [
465+
{
466+
workspaceResourceId: logAnalyticsWorkspaceResourceId
467+
name: 'la-${dataCollectionRulesResourceName}'
468+
}
469+
]
470+
}
471+
dataFlows: [
472+
{
473+
streams: [
474+
'Microsoft-SecurityEvent'
475+
]
476+
destinations: [
477+
'la-${dataCollectionRulesResourceName}'
478+
]
479+
}
480+
]
481+
}
394482
}
395483
}
396484

0 commit comments

Comments
 (0)